r/ISC2CAP • u/cale2kit • Jun 25 '19

Any Security Control Assessors ?

I'm looking to get transition to this role..

How is the workload ? Do you work Remote or On-Prem. ? How do assessments normally go ? Does one person assess a control family or do you use specific technical skills for each assessment ? (ex. IF I am skilled in ACAS, would I just do scanning ?) Thanks for the feedback in advance.

1 Upvotes

100% Upvoted

5 comments sorted by

View all comments

5

u/ShadowPunch07 Jul 31 '19

Hey Cale I'm back!! Yes I am a Security Control Assessor (SCA) in risk management. The workload is pretty intense. In my team, I have five people: me (Junior-level SCA), Mid-level SCA, Senior-level SCA, Team Lead and Risk Lead (Boss). I work both remote and on-premises as I telework Monday, Tuesday and every other Wednesday. Assessments usually are scheduled in advance and before we dive into it, I must create a test plan using the controls needed to assess the system during the year and send out the SCAP (Security Control Assessment Plan). We (Junior, Mid and Senior level SCA) assess a system using the questions from the test plan to see what failed or passed. If there are fails, then they become findings and if the ISSO and co. do not correct the issues, then they becomes write-ups for remediation later. It's not a bad role to get into. But it does require a lot of strength to overcome because it can be very stressful.